Method of generating a common event format representation of information from a plurality of messages using rule-based directives and computer keys

• US 7,475,150 B2
• Filed: 09/07/2004
• Issued: 01/06/2009
• Est. Priority Date: 09/07/2004
• Status: Expired due to Fees

• Current Assignee: International Business Machines Corporation
• Original Assignee: International Business Machines Corporation
• Inventors: Grabarnik, Genady, Subramanian, Balan, Salahshour, Abdolreza, Ma, Sheng
• Primary Examiner(s): Nguyen; Quang N.
• Application Number:
  US10/935,035
• Publication Number:
  US 20060053477A1
• Time in Patent Office: 1,582 Days
• Field of Search: 709/223, 709/228, 709/246, 709/100, 719/313, 719/318, 707/3, 707/100, 713/201, 714/48
• US Class Current: 709/228
• CPC Class Codes: G06F 11/0709 in a distributed system consisting of a plurality of standalone computer nodes, e.g. clusters, client-server systems
• CPC Class Codes: G06F 11/0769 Readable error formats, e.g. cross-platform generic formats, human understandable formats
• CPC Class Codes: G06F 11/3006 where the computing system is distributed, e.g. networked systems, clusters, multiprocessor systems multiprogramming arrangements G06F9/46; allocation of resources G06F9/50
• CPC Class Codes: G06F 11/3068 where the reporting involves data format conversion
• CPC Class Codes: H04L 41/06 Management of faults, events, alarms or notifications
• CPC Class Codes: H04L 41/16 using machine learning or artificial intelligence

Abstract

Methods, systems, and computer program products for generating a common event format representation of information from a plurality of messages include parsing a rule associated with a current message to determine if a property of a common event format representation for the current message is to be populated with a property value from a previous message. If the rule specifies to obtain the property value from the previous message, the property value is obtained from the previous message and the common event format representation for the current message is populated with the obtained property value from the previous message. The property value may be obtained by generating a computed key based on properties of the current message that are common to the previous message, and identifying the previous message based on the key of the current message. The rule associated with the current message may also be parsed to determine if the property of the common event format representation for the current message is to be populated with a property value determined by specified code. If the rule specifies to obtain the property value using the specified code, the property value is obtained using the specified code and the common event format representation for the current message is populated with the obtained property value obtained using the specified code.

Claims

1. A method of generating a common event format representation of information from a plurality of messages, comprising:

parsing a rule associated with a current message to determine if a property of a common event format representation for the current message is to be populated with a property value from a previous message;

obtaining the property value from the previous message if the rule specifies to obtain the property value from the previous message, wherein obtaining the property value from the previous message comprises;

generating a computed key based on properties of the current message, wherein generating the computed key further includes;

identifying properties in the current message that are common to the previous message;

combining the identified properties to generate the computed key; and

generating only a portion of the computed key sufficient to identify a previous message;

wherein obtaining the property value from the previous message comprises obtaining the property value from an immediately preceding message if the rule specifies to obtain the property value from the immediately preceding message or if obtaining the property value from the previous message is unsuccessful;

wherein the obtained property value from the previous message provides further directives for determining the property of the common event format representation for the current message;

identifying the previous message based on the key of the current message, wherein identifying the previous message comprises;

identifying the previous message based on a portion of the key;

generating a key for the previous message based on properties of the previous message; and

comparing the key for the previous message with the key for the current message;

populating the common event format representation for the current message with the obtained property value from the previous message;

parsing the rule associated with the current message to determine if the property of the common event format representation for the current message is to be populated with a property value determined by a specified code;

obtaining the property value using the specified code if the rule specifies to obtain the property value using the specified code;

populating the common event format representation for the current message with the obtained property value obtained using the specified code;

storing the populated common event format representation as the current message;

wherein the rule specifies obtaining the property value from the specified code if obtaining the property value from the previous message is unsuccessful;

wherein the specified code calls a class and a particular method within the class to determine the property value;

wherein obtaining the property value from the specified code comprises re-using a property value from a previous execution of the specified code if the same class, method, and parameters as the previous execution are specified;

wherein the specified code creates a new object to call a method to determine the property value;

storing the new object against a called class, method, and parameters;

wherein the steps of parsing, obtaining, and populating includes;

parsing a rule associated with a current message to determine if a property of a common event format representation for the current message is to be populated with a property value from a previous message or if the property of the common event format representation for the current message is to be populated with a property value determined by specified code;

obtaining the property value from the previous message if the rule specifies obtaining the property value from the previous message, wherein obtaining the property value comprises;

generating a computed key based on properties of the current message that are common to the previous message; and

identifying the previous message based on the computed key of the current message;

obtaining the property value from the specified code if the rule specifies to obtain the property value from the specified code, wherein the specified code calls a class and a particular method within the class to determine the property value; and

populating the common event format representation for the current message with the obtained property value.